Securing Express APIs (CORS, Helmet, Rate Limiting)

Hardening Express Applications

Production Express APIs must defend against common web application vulnerabilities (OWASP Top 10).

1. Cross-Origin Resource Sharing (CORS)

Prevents unauthorized websites from making cross-origin requests to your API.

const cors = require("cors");

const corsOptions = {
  origin: ["https://myapp.com", "https://admin.myapp.com"],
  methods: ["GET", "POST", "PUT", "DELETE"],
  credentials: true
};

app.use(cors(corsOptions));

2. Helmet HTTP Security Headers

Sets security headers like Content-Security-Policy, X-Frame-Options, and Strict-Transport-Security.

const helmet = require("helmet");
app.use(helmet());

3. Rate Limiting to Prevent Denial of Service (DoS)

Limits repeated requests from an IP address to public endpoints.

const rateLimit = require("express-rate-limit");

const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // Limit each IP to 100 requests per windowMs
  standardHeaders: true,
  legacyHeaders: false
});

app.use("/api/", apiLimiter);

TL;DR

• Secure cross-origin access with cors.
• Set HTTP headers with helmet.
• Prevent brute-force and spam with express-rate-limit.